@jrpool/kilotest 49.0.0 → 51.1.0

package/robots.txt

@@ -2,6 +2,7 @@
 User-agent: *
 Allow: /
 Disallow: /ai0BalanceForm.html
+Disallow: /deleteNotesForm.html
 Disallow: /enqueueForm.html
 Disallow: /recAction.html
 Disallow: /reannotateForm.html

package/smokeTest.ts

@@ -41,6 +41,7 @@ const concretePaths: Record<string, Record<string, string>> = {
     '/api/*': '/api/requestFeature',
     '/mcp': '/mcp',
     '/ai0BalanceForm.html': '/ai0BalanceForm.html',
+    '/deleteNotesForm.html': '/deleteNotesForm.html',
     '/expungeReportsForm.html': '/expungeReportsForm.html',
     '/hideReportForm.html': '/hideReportForm.html',
     '/metrics.html': '/metrics.html',
@@ -64,6 +65,7 @@ const postBodies: Record<string, object> = {
   '/api/requestFeature': {feature: 'smoke test'},
   '/mcp': {},
   '/ai0BalanceForm.html': {authCode: 'invalid'},
+  '/deleteNotesForm.html': {authCode: 'invalid'},
   '/expungeReportsForm.html': {authCode: 'invalid'},
   '/hideReportForm.html': {authCode: 'invalid'},
   '/metrics.html': {authCode: 'invalid'},
@@ -229,20 +231,23 @@ const isMCPErrorResponse = (result: {statusCode: number | undefined, body: strin
     console.log(`FAIL: POST ${mcpPath} initialize -> error: ${message}`);
     failures++;
   }
-  // Send a browser-style GET to verify that invalid MCP requests get JSON-RPC errors end-to-end.
+  // Send a POST with an Accept header the MCP SDK itself rejects (missing text/event-stream)
+  // to verify that invalid MCP requests get JSON-RPC errors end-to-end. A browser-style GET
+  // is not used here because index.ts deliberately intercepts it before handleMCP, serving a
+  // human-readable explainer page instead of a JSON-RPC error.
   try {
-    const probe = await sendMCPRequest('GET', 'text/html');
+    const probe = await sendMCPRequest('POST', 'application/json', mcpInitialize);
     if (isMCPErrorResponse(probe)) {
-      console.log(`PASS: GET ${mcpPath} browser -> ${probe.statusCode} (JSON-RPC error)`);
+      console.log(`PASS: POST ${mcpPath} bad accept -> ${probe.statusCode} (JSON-RPC error)`);
     }
     else {
-      console.log(`FAIL: GET ${mcpPath} browser -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
+      console.log(`FAIL: POST ${mcpPath} bad accept -> ${probe.statusCode} (body: ${probe.body.slice(0, 120)})`);
       failures++;
     }
   }
   catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    console.log(`FAIL: GET ${mcpPath} browser -> error: ${message}`);
+    console.log(`FAIL: POST ${mcpPath} bad accept -> error: ${message}`);
     failures++;
   }
   console.log(`\n=== ${failures === 0 ? 'All checks passed' : `${failures} failure(s)`} ===`);

package/util.test.ts

@@ -9,10 +9,20 @@ import {test, before, after} from 'node:test';
 import assert from 'node:assert/strict';
 import path from 'node:path';
 import fs from 'node:fs/promises';
+
+// Blank the alert configuration unconditionally, before util.ts (which processTestRequest
+// calls sendAlert from) is ever imported below, so this file sends no real alert emails
+// even when run directly (e.g. `npx tsx --test util.test.ts`) rather than via `npm test`,
+// which normally guards against this via test/setup.ts.
+for (const key of ['MANAGER_EMAIL', 'ALERT_API_HOST', 'ALERT_API_PATH', 'ALERT_API_KEY', 'ALERT_FROM']) {
+  process.env[key] = '';
+}
+
 import {
   annotateReportObject,
   checkCommentDuplicate,
   checkCommentLength,
+  checkLength,
   createLock,
   dbPath,
   getAgoDays,
@@ -45,6 +55,7 @@ import {
   isReportAvailable,
   isTimeStamp,
   isURL,
+  isValidAuthCode,
   jobsPath,
   makeBreakable,
   minifyURL,
@@ -83,31 +94,49 @@ test('checkCommentLength rejects a comment longer than 1000 characters', () => {
   });
 });
 
-test('checkCommentDuplicate accepts a comment with no existing comments', () => {
-  const result = checkCommentDuplicate([], 'a'.repeat(20));
+test('checkLength accepts text at the minimum bound', () => {
+  const result = checkLength('a'.repeat(5), 5, 10, 'reason');
   assert.deepEqual(result, {status: 'ok'});
 });
 
-test('checkCommentDuplicate rejects a comment repeating one submitted within the last 1000 seconds', () => {
-  const content = 'a'.repeat(20);
-  const comments = [{timeStamp: getNowStamp(), content}];
-  const result = checkCommentDuplicate(comments, content);
+test('checkLength accepts text at the maximum bound', () => {
+  const result = checkLength('a'.repeat(10), 5, 10, 'reason');
+  assert.deepEqual(result, {status: 'ok'});
+});
+
+test('checkLength rejects text shorter than the minimum bound', () => {
+  const result = checkLength('a'.repeat(4), 5, 10, 'reason');
+  assert.deepEqual(result, {
+    status: 'error',
+    message: 'The reason must be between 5 and 10 characters long'
+  });
+});
+
+test('checkLength rejects text longer than the maximum bound', () => {
+  const result = checkLength('a'.repeat(11), 5, 10, 'reason');
   assert.deepEqual(result, {
     status: 'error',
-    message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+    message: 'The reason must be between 5 and 10 characters long'
   });
 });
 
-test('checkCommentDuplicate accepts a comment repeating one submitted more than 1000 seconds ago', () => {
+test('checkCommentDuplicate accepts a comment with no existing comments', () => {
+  const result = checkCommentDuplicate([], 'a'.repeat(20));
+  assert.deepEqual(result, {status: 'ok'});
+});
+
+test('checkCommentDuplicate rejects a comment identical to one already stored, regardless of when', () => {
   const content = 'a'.repeat(20);
-  const oldTimeStamp = getTimeStamp(new Date(Date.now() - 2000000));
-  const comments = [{timeStamp: oldTimeStamp, content}];
+  const comments = [{content}];
   const result = checkCommentDuplicate(comments, content);
-  assert.deepEqual(result, {status: 'ok'});
+  assert.deepEqual(result, {
+    status: 'error',
+    message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
+  });
 });
 
-test('checkCommentDuplicate accepts a comment that differs from a recent one', () => {
-  const comments = [{timeStamp: getNowStamp(), content: 'a'.repeat(20)}];
+test('checkCommentDuplicate accepts a comment that differs from a stored one', () => {
+  const comments = [{content: 'a'.repeat(20)}];
   const result = checkCommentDuplicate(comments, 'b'.repeat(20));
   assert.deepEqual(result, {status: 'ok'});
 });
@@ -337,6 +366,42 @@ test('isURL returns false for an invalid URL', () => {
   assert.equal(isURL('not-a-url'), false);
 });
 
+test('isValidAuthCode returns true when the code matches AUTH_CODE', () => {
+  const saved = process.env.AUTH_CODE;
+  process.env.AUTH_CODE = 'secret-code';
+  try {
+    assert.equal(isValidAuthCode('secret-code'), true);
+  }
+  finally {
+    if (saved === undefined) {
+      delete process.env.AUTH_CODE;
+    }
+    else {
+      process.env.AUTH_CODE = saved;
+    }
+  }
+});
+
+test('isValidAuthCode returns false when the code does not match AUTH_CODE', () => {
+  const saved = process.env.AUTH_CODE;
+  process.env.AUTH_CODE = 'secret-code';
+  try {
+    assert.equal(isValidAuthCode('wrong-code'), false);
+  }
+  finally {
+    if (saved === undefined) {
+      delete process.env.AUTH_CODE;
+    }
+    else {
+      process.env.AUTH_CODE = saved;
+    }
+  }
+});
+
+test('isValidAuthCode returns false for an undefined code', () => {
+  assert.equal(isValidAuthCode(undefined), false);
+});
+
 test('makeBreakable inserts wbr before non-initial slashes', () => {
   assert.equal(makeBreakable('/api/listReports'), '/api<wbr>/listReports');
 });

package/util.ts

@@ -173,6 +173,24 @@ export type ReportData = {
 const alphaCompare = (a: string, b: string) => a.localeCompare(b, 'en', {sensitivity: 'base'});
 // Sorts strings alphabetically and case-insensitively.
 const alphaSort = (strings: string[]) => strings.sort((a, b) => alphaCompare(a, b));
+// Returns whether a string's length is within the given bounds. Generic length check
+// shared by any field with a min/max character-count rule (e.g. a request description
+// or reason), so each caller states its own bounds and label instead of hardcoding an
+// ad hoc length comparison.
+export const checkLength = (
+  text: string, min: number, max: number, label: string
+): {status: 'ok'} | {status: 'error'; message: string} => {
+  const {length} = text;
+  // If the length is invalid:
+  if (length < min || length > max) {
+    // Return the applicable error message.
+    return {
+      status: 'error',
+      message: `The ${label} must be between ${min} and ${max} characters long`
+    };
+  }
+  return {status: 'ok'};
+};
 // Returns whether a comment's raw length is within the 20-to-1000-character bounds.
 export const checkCommentLength = (
   content: string
@@ -189,27 +207,22 @@ export const checkCommentLength = (
   }
   return {status: 'ok'};
 };
-// Returns whether a comment repeats, verbatim, one of the given comments submitted
-// within the last 1000 seconds. Comment time stamps use Kilotest's own timeStamp
-// format (see getTimeStamp), not an ISO date-time string, so this integrates with
-// the same comments.json shape that web/tutorial/index.ts already uses. The content
-// passed in should be the content as it will be stored (e.g. after sanitization),
-// so that it is compared on the same basis as the stored comments.
+// Returns whether a comment repeats, verbatim, one of the given comments, regardless
+// of when the earlier one was submitted: a legitimate need to resubmit exactly the
+// same content never arises (the near-term case is a browser "Back" resubmission),
+// so storing a second copy would only ever be redundant. The content passed in
+// should be the content as it will be stored (e.g. after sanitization), so that it
+// is compared on the same basis as the stored comments. Content, not any time
+// stamp, is what this checks and what identifies a comment as unique.
 export const checkCommentDuplicate = (
-  comments: {timeStamp: string; content: string}[], content: string
+  comments: {content: string}[], content: string
 ): {status: 'ok'} | {status: 'error'; message: string} => {
-  // Get the comments submitted within the last 1000 seconds with the same content.
-  // Comment time stamps are always valid, because this codebase is the sole writer
-  // of comments.json.
-  const duplicates = comments
-  .filter(comment => getDateTime(comment.timeStamp)!.getTime() > Date.now() - 1000000)
-  .filter(comment => comment.content === content);
-  // If the comment duplicates a recent one:
-  if (duplicates.length) {
+  // If the comment duplicates one already stored:
+  if (comments.some(comment => comment.content === content)) {
     // Return this.
     return {
       status: 'error',
-      message: 'Your comment repeats a recently submitted one, but you are welcome to submit a different comment'
+      message: 'Your comment is identical to one already submitted, but you are welcome to submit a different comment'
     };
   }
   // Otherwise, the comment is not a duplicate.
@@ -536,6 +549,12 @@ export const isURL = (string: string): boolean => {
     return false;
   }
 };
+// Returns whether a string is the authorization code, the shared check every
+// manager-facing page and action uses to gate a submission. Centralized so all call
+// sites compare against process.env.AUTH_CODE the same way.
+export const isValidAuthCode = (authCode: string | undefined | null): boolean => {
+  return !!authCode && authCode === process.env.AUTH_CODE;
+};
 // Makes a string breakable before non-initial slashes.
 export const makeBreakable = (string: string): string => string.replace(/\//g, '<wbr>/').replace(/^<wbr>/, '');
 // Minifies a URL for duplicate detection.

package/web/ai0BalanceForm/index.ts

@@ -7,7 +7,7 @@
 
 import fs from 'node:fs/promises';
 import {balancePath} from '../../balances.ts';
-import {getJSON, populateTemplate} from '../../util.ts';
+import {getJSON, isValidAuthCode, populateTemplate} from '../../util.ts';
 
 // FUNCTIONS
 
@@ -22,7 +22,7 @@ export const answer = async (_: any, search: string, method: string) => {
   // If the form has been submitted:
   if (method === 'POST' && newBalanceString) {
     // If the authorization code is valid:
-    if (authCode === process.env.AUTH_CODE) {
+    if (isValidAuthCode(authCode)) {
       const newBalance = Number.parseFloat(newBalanceString);
       // If the new balance is valid:
       if (

package/web/deleteNotesForm/deleteNotesForm.test.ts

@@ -0,0 +1,237 @@
+/*
+  deleteNotesForm.test.ts
+  Unit tests for web/deleteNotesForm/index.ts.
+*/
+
+// IMPORTS
+
+import {test, before, beforeEach, after} from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// ENVIRONMENT
+
+const testDir = path.join(import.meta.dirname, '../../test/fixtures/deleteNotesForm');
+const tutorialWebPath = path.join(testDir, 'tutorialWeb.json');
+const tutorialAIPath = path.join(testDir, 'tutorialAI.json');
+const featureRequestsPath = path.join(testDir, 'featureRequests.json');
+
+const savedAuthCode = process.env.AUTH_CODE;
+const savedTutorialWebPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+const savedTutorialAIPath = process.env.TUTORIAL_AI_COMMENTS_PATH;
+const savedFeatureRequestsPath = process.env.FEATURE_REQUESTS_PATH;
+
+before(async () => {
+  process.env.AUTH_CODE = 'test-auth-code';
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = tutorialWebPath;
+  process.env.TUTORIAL_AI_COMMENTS_PATH = tutorialAIPath;
+  process.env.FEATURE_REQUESTS_PATH = featureRequestsPath;
+  await fs.mkdir(testDir, {recursive: true});
+});
+
+beforeEach(async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'A web tutorial comment'}
+  ]));
+  await fs.writeFile(tutorialAIPath, JSON.stringify([
+    {timeStamp: '260102T0000', content: 'An AI tutorial comment'}
+  ]));
+  await fs.writeFile(featureRequestsPath, JSON.stringify([
+    {timeStamp: '260103T0000', content: 'A feature request'}
+  ]));
+});
+
+import {answer} from './index.ts';
+
+after(async () => {
+  if (savedAuthCode !== undefined) {
+    process.env.AUTH_CODE = savedAuthCode;
+  }
+  if (savedTutorialWebPath !== undefined) {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedTutorialWebPath;
+  } else {
+    delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  }
+  if (savedTutorialAIPath !== undefined) {
+    process.env.TUTORIAL_AI_COMMENTS_PATH = savedTutorialAIPath;
+  } else {
+    delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  }
+  if (savedFeatureRequestsPath !== undefined) {
+    process.env.FEATURE_REQUESTS_PATH = savedFeatureRequestsPath;
+  } else {
+    delete process.env.FEATURE_REQUESTS_PATH;
+  }
+  await fs.rm(testDir, {recursive: true, force: true});
+});
+
+// TESTS
+
+test('deleteNotesForm lists notes from all three sources on a GET request', async () => {
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+  assert.ok(result.answerPage!.includes('An AI tutorial comment'));
+  assert.ok(result.answerPage!.includes('A feature request'));
+});
+
+test('deleteNotesForm ignores a note query string on a GET request', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'GET'
+  );
+  assert.equal(result.status, 'ok');
+  // The note should NOT have been deleted by a mere GET request.
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm returns an error for an invalid auth code on a POST request', async () => {
+  const result = await answer(
+    null,
+    `authCode=wrong&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'error');
+  assert.equal(result.message, 'Invalid request');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+});
+
+test('deleteNotesForm deletes a selected web tutorial comment with a valid auth code', async () => {
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+  // The other sources are untouched.
+  const aiNotes = JSON.parse(await fs.readFile(tutorialAIPath, 'utf8'));
+  assert.equal(aiNotes.length, 1);
+});
+
+test('deleteNotesForm deletes selected notes across multiple sources in one submission', async () => {
+  const result = await answer(
+    null,
+    'authCode=test-auth-code' +
+      `&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}` +
+      `&note=tutorialAI%09${encodeURIComponent('An AI tutorial comment')}` +
+      `&note=featureRequest%09${encodeURIComponent('A feature request')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  assert.equal(JSON.parse(await fs.readFile(tutorialWebPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(tutorialAIPath, 'utf8')).length, 0);
+  assert.equal(JSON.parse(await fs.readFile(featureRequestsPath, 'utf8')).length, 0);
+});
+
+test('deleteNotesForm leaves unselected notes in a source intact', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: 'Keep this one'},
+    {timeStamp: '260101T0001', content: 'Delete this one'}
+  ]));
+  const result = await answer(
+    null,
+    `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('Delete this one')}`,
+    'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 1);
+  assert.equal(notes[0].content, 'Keep this one');
+});
+
+test('deleteNotesForm reports no notes to delete when all sources are empty', async () => {
+  await fs.writeFile(tutorialWebPath, '[]');
+  await fs.writeFile(tutorialAIPath, '[]');
+  await fs.writeFile(featureRequestsPath, '[]');
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('There are no comments or feature requests to delete.'));
+});
+
+test('deleteNotesForm treats a missing source file as having no notes', async () => {
+  await fs.rm(featureRequestsPath, {force: true});
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes('A web tutorial comment'));
+});
+
+test('deleteNotesForm escapes note content to prevent HTML injection', async () => {
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content: '<script>alert(1)</script>'}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(!result.answerPage!.includes('<script>'));
+});
+
+test('deleteNotesForm deletes a note whose content contains a literal tab character', async () => {
+  const content = 'Line one\tLine two, after an embedded tab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(
+    null, `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent(content)}`, 'POST'
+  );
+  assert.equal(result.status, 'ok');
+  const notes = JSON.parse(await fs.readFile(tutorialWebPath, 'utf8'));
+  assert.equal(notes.length, 0);
+});
+
+test('deleteNotesForm renders a checkbox value that round-trips a note with a literal tab', async () => {
+  const content = 'Has\ta\ttab';
+  await fs.writeFile(tutorialWebPath, JSON.stringify([
+    {timeStamp: '260101T0000', content}
+  ]));
+  const result = await answer(null, '', 'GET');
+  assert.equal(result.status, 'ok');
+  assert.ok(result.answerPage!.includes(`tutorialWeb\t${encodeURIComponent(content)}`));
+});
+
+test('deleteNotesForm returns an error when a note file cannot be written', async () => {
+  // Point the web tutorial comments path at a location whose parent is a file, so that
+  // creating the directory for it fails.
+  const blockerFile = path.join(testDir, 'blocker');
+  const unwritablePath = path.join(blockerFile, 'tutorialWeb.json');
+  await fs.writeFile(blockerFile, 'not a directory');
+  const savedPath = process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  process.env.TUTORIAL_WEB_COMMENTS_PATH = unwritablePath;
+  try {
+    const result = await answer(
+      null,
+      `authCode=test-auth-code&note=tutorialWeb%09${encodeURIComponent('A web tutorial comment')}`,
+      'POST'
+    );
+    assert.equal(result.status, 'error');
+    assert.ok(result.message?.includes('Deleting notes failed'));
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = savedPath;
+    await fs.unlink(blockerFile).catch(() => {});
+  }
+});
+
+test('deleteNotesForm falls back to default paths when environment variables are not set', async () => {
+  const saved = {
+    tutorialWeb: process.env.TUTORIAL_WEB_COMMENTS_PATH,
+    tutorialAI: process.env.TUTORIAL_AI_COMMENTS_PATH,
+    featureRequest: process.env.FEATURE_REQUESTS_PATH
+  };
+  delete process.env.TUTORIAL_WEB_COMMENTS_PATH;
+  delete process.env.TUTORIAL_AI_COMMENTS_PATH;
+  delete process.env.FEATURE_REQUESTS_PATH;
+  try {
+    // None of the default db/ files exist in this environment, so the form should
+    // still render, treating each missing source as having no notes.
+    const result = await answer(null, '', 'GET');
+    assert.equal(result.status, 'ok');
+  } finally {
+    process.env.TUTORIAL_WEB_COMMENTS_PATH = saved.tutorialWeb;
+    process.env.TUTORIAL_AI_COMMENTS_PATH = saved.tutorialAI;
+    process.env.FEATURE_REQUESTS_PATH = saved.featureRequest;
+  }
+});

package/web/deleteNotesForm/index.html

@@ -0,0 +1,29 @@
+<!DOCTYPE html>
+<html lang="en-US">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <meta name="publisher" content="Jonathan Robert Pool">
+    <meta name="creator" content="Jonathan Robert Pool">
+    <meta name="keywords" content="report,accessibility,a11y">
+    <title>Delete notes | Kilotest</title>
+    <link rel="icon" href="/favicon.ico">
+    <link rel="stylesheet" href="/style.css">
+  </head>
+  <body>
+    <main>
+      <h1><a href="/">Kilotest</a>: Delete notes</h1>
+      <p>__intro__</p>
+      <form action="/deleteNotesForm.html" method="post">
+        <fieldset>
+          <legend>Notes</legend>
+          __notes__
+        </fieldset>
+        <p><label>
+          Authorization code: <input size="3" minLength="3" maxlength="3" name="authCode" required__disabled__>
+        </label></p>
+        <p><button type="submit"__disabled__>Submit</button></p>
+      </form>
+    </main>
+  </body>
+</html>